OVER 40,000 WordPress installations are at risk after a critical authentication bypass was found in the User Profile Builder plugin.
The flaw is tracked as CVE-2026-15826 according to Wordfence.
The flaw stems from a type confusion error in the plugin’s login flow, allowing unauthenticated attackers to gain administrator privileges.
Details were highlighted by Infosecurity Magazine in their coverage.
Versions 3.16.4 and earlier are affected, and the vulnerability carries a CVSS score of 9.8, reflecting its high severity.
This information was also noted by Securityonline in their report.
Analysis shows the issue arises from insufficient checks during registration and automatic login, which could let an attacker create a rogue admin account or plant a backdoor.
No threat actors have been publicly linked to the vulnerability so far.
Defenders are urged to update to version 3.16.5 or later immediately, as the patched release resolves the authentication bypass.
If updating is not feasible right away, site administrators should disable the Automatically Log In option within the plugin settings.
Enforcing stronger password policies for all accounts and reviewing recent admin logins for anomalies are also recommended steps.
Additionally, enabling multi-factor authentication where supported can help mitigate potential compromise.